Hey,

I've attached a fix for an engine level crash in switch() when it is
used with string offsets.  This eliminates a double-free and valgrind
reports that no new leaks have been introduced.

-Sterling
Index: zend_execute.c
===================================================================
RCS file: /repository/ZendEngine2/zend_execute.c,v
retrieving revision 1.582
diff -u -r1.582 zend_execute.c
--- zend_execute.c      8 Jan 2004 17:31:47 -0000       1.582
+++ zend_execute.c      13 Jan 2004 19:58:18 -0000
@@ -194,13 +194,7 @@
 {
        switch (opline->op1.op_type) {
                case IS_VAR:
-                       if (!T(opline->op1.u.var).var.ptr_ptr) {
-                               temp_variable *T = &T(opline->op1.u.var);
-                               /* perform the equivalent of equivalent of a
-                                * quick & silent get_zval_ptr, and FREE_OP
-                                */
-                               PZVAL_UNLOCK(T->var.str_offset.str);
-                       } else {
+                       if (T(opline->op1.u.var).var.ptr_ptr) {
                                zval_ptr_dtor(&T(opline->op1.u.var).var.ptr);
                                if (opline->extended_value) { /* foreach() free */
                                        zval_ptr_dtor(&T(opline->op1.u.var).var.ptr);

-- 
PHP Internals - PHP Runtime Development Mailing List
To unsubscribe, visit: http://www.php.net/unsub.php

Reply via email to